As measles cases in the United States climb to their highest level in more than three decades, public health officials are renewing calls for vaccination and other preventive steps to help slow the spread of a virus considered among the most contagious known to medicine.

According to the Centers for Disease Control and Prevention, 3,471 confirmed measles cases had been reported across the United States as of September 17, making 2026 the worst year for measles in the country since 1991. The agency has logged 38 new outbreaks so far this year, with 95% of confirmed cases tied to those outbreaks. Utah currently has the largest active outbreak, with more than 500 cases reported, while Pennsylvania has emerged as a newer hot spot in recent weeks. Roughly 93% of measles patients nationally are unvaccinated or have an unknown vaccination status, according to CDC surveillance data, underscoring the central role vaccination gaps have played in driving the current surge.

Health officials point to declining childhood vaccination rates as the primary driver behind the outbreak’s scale. Vaccination coverage among U.S. kindergartners has fallen from 95.2% during the 2019-2020 school year to 92.4% in the 2025-2026 school year, leaving an estimated 280,000 kindergartners without documented protection against the virus this year. Researchers have estimated that even a 1% decline in childhood MMR vaccination rates could translate into roughly 17,000 additional measles cases, 4,000 hospitalizations and 36 preventable deaths annually.

Dr. Dave Chokshi, chair of the Common Health Coalition, emphasized the stakes tied to maintaining strong community vaccination levels. “Vaccination is one of the most powerful investments we can make for the health of our children, but when we fail to maintain high vaccination rates, we all pay the price,” Chokshi said. William Moss of the Johns Hopkins Bloomberg School of Public Health similarly flagged the unusual pace of this year’s outbreak. “Reaching this milestone is particularly striking because we are only in July, and measles cases are still being reported throughout the country, with outbreaks in Virginia and Pennsylvania,” Moss said, in comments made earlier this year as case totals continued climbing through the summer.

With that backdrop in mind, public health guidance points to several concrete steps individuals and families can take to reduce their risk of measles infection.

The first and most effective step remains vaccination. Two doses of the measles, mumps and rubella, or MMR, vaccine are 97% effective at preventing measles, while a single dose offers roughly 93% protection, according to CDC data. The American Academy of Pediatrics recommends routine MMR vaccination for all children as the primary defense against the virus.

Second, families should follow the CDC’s standard childhood vaccination schedule, which calls for the first MMR dose between 12 and 15 months of age and a second dose between ages 4 and 6, ensuring children reach the full two-dose protection level before entering school.

Third, adults and older children who are unsure of their own vaccination history should check with their healthcare provider or state immunization registry to confirm whether they have documented evidence of measles immunity, since gaps in adult vaccination records are common and can leave people unknowingly at risk.

Fourth, anyone planning international travel, including infants as young as 6 months old, should consult a healthcare provider about receiving an early or additional MMR dose before departure, given that global measles activity has continued rising and unvaccinated travelers face elevated exposure risk in many destinations.

Fifth, individuals who develop symptoms consistent with measles, including high fever, cough, runny nose, red or watery eyes and a distinctive rash that typically begins on the face and spreads downward, should isolate themselves from others and contact a healthcare provider promptly, ideally by phone before visiting in person, to avoid exposing others in a waiting room.

Sixth, given how easily measles spreads, with the CDC noting that up to nine out of ten unprotected people nearby will become infected if exposed to someone with the virus, avoiding close contact with anyone showing symptoms of measles is an important precaution, particularly for infants too young to be vaccinated and people with weakened immune systems.

Seventh, practicing routine hand hygiene, including regular handwashing, can help reduce the risk of picking up the virus from contaminated surfaces, even though measles spreads primarily through airborne respiratory droplets rather than surface contact alone.

Eighth, staying informed about outbreaks in your local area through state and local health department alerts can help residents make more informed decisions about vaccination timing and precautions, particularly in communities currently experiencing active outbreaks such as Utah and Pennsylvania.

Ninth, communities benefit collectively from high overall vaccination coverage, since widespread immunity helps protect infants too young for vaccination and individuals who cannot receive the vaccine for medical reasons, a concept public health officials refer to as community or herd immunity.

Tenth, individuals with weakened immune systems, pregnant women, or those with specific medical conditions should consult their healthcare provider directly about additional precautions or guidance tailored to their individual health circumstances, since vaccination recommendations can vary for people with certain underlying health conditions.

With the CDC warning that continued domestic and international travel is likely to produce additional measles cases in the coming months, and with the United States now at risk of losing the official measles elimination status it achieved in 2000, health officials say maintaining high vaccination coverage remains the single most effective tool available for bringing the current surge under control.

Somewhere between the insurance certificates and the cyber security questions, larger clients have started asking what AI tools their suppliers use, whether client data goes into them, and who signed that off. Most small businesses cannot answer, because nobody ever decided staff simply started using things.

If you supply anyone larger than you, this is arriving. Here is what will be asked and how to be ready, which turns out to be a smaller job than it sounds.

Why this is landing on small suppliers

Large organisations have spent the past two years writing internal AI policies. Those policies do not stop at their own staff.

Governance obligations flow down a supply chain through contracts and due diligence. When a

client commits to controlling where its data goes, it has to ask the same of everyone it sends data to, which includes your firm. The questionnaire is simply that commitment arriving in your inbox.

The mistake is treating it as a technology question. It is a commercial one. Suppliers who cannot answer get delayed, escalated, or quietly dropped from a shortlist.

The questions you should be able to answer

Six come up repeatedly, and none require technical knowledge to answer well.

Which AI tools does your team use? Including the ones nobody approved. This is the hardest

question for most small firms and the one you should answer honestly.

Does any of our data go into them? Client names, documents, spreadsheets, correspondence. Be specific rather than reassuring.

Are our inputs used to train models? Consumer plans and business plans often differ here, and most firms do not know which they are on.

Where is the data processed, and under whose law? Increasingly asked by clients in regulated sectors and by anyone with their own EU or UK obligations.

Who approved it? A named person, not “the team”. Governance questions want an owner.

What happens when someone leaves? If an employee’s personal account holds three years of client work, that is a real exposure and an easy one to describe badly.

Answering “we don’t use AI” is a poor strategy. It is usually untrue, and it is increasingly not believed.

Get your own house in order first

Start by finding out what is actually being used, without making it a disciplinary matter. Shadow

usage almost always exists because the official route was slower than the deadline, and people will tell you if the question is asked neutrally.

Then write a policy that fits on one page. What may go into an AI tool, what may not, which tools are approved, and who to ask. Long policies do not get read and therefore do not change behaviour.

Give each approved tool a named owner responsible for deciding whether it stays. Unowned tools are the ones that turn up in a questionnaire nobody can answer.

Where UK law actually bites

This is less dramatic than headlines suggest, but it is not nothing.

The ICO requires a Data Protection Impact Assessment where processing is “likely to result in a high risk to the rights and freedoms of natural persons”. Its list of indicators includes the use of innovative technology, invisible processing where data is obtained indirectly, and large-scale profiling. Putting personal data through an AI tool frequently touches at least one.

That does not make AI unlawful. It means you are expected to have thought about the risk and recorded that you did. For most small firms, a short screening assessment covering what data goes in, why, and what could go wrong is proportionate and sufficient.

The failure mode regulators care about is not using AI. It is using it with personal data while having no idea that you are.

Choosing tools with the questionnaire in mind

Once you have seen the questions, tool selection changes shape. The useful criterion is no longer just capability, it is whether you can hand a client a straight answer about the tool’s data terms.

Sometimes that means moving from consumer to business plans on what you already use, which changes the default terms immediately. Sometimes it means choosing an AI assistant for business that does not train on your inputs at all. Often it means neither, and simply keeping client material out of these tools while using them freely for everything else.

Whatever you choose, keep the documentation. The single most useful artifact in a due diligence process is a one-page summary of which tools you use, what data touches them, and where that data goes.

The part that is actually an opportunity

Most of this reads as a burden. It is also a genuine advantage for firms that move early.

Procurement teams at larger organisations are being slowed down badly by suppliers who cannot answer these questions. A small firm that responds inside a day, with a clear one-page document, stands out against competitors who need three weeks and a meeting.

Several sectors are heading toward this becoming a standard rather than a differentiator.

Being early is worth more now than it will be in eighteen months.

What to do this month

Ask your team what they use, without consequences attached. Expect surprises.

Move anyone on consumer plans doing client work onto business plans. This is the highest-value hour in the whole exercise, because it changes the default data terms across the board.

Write the one-page policy and the one-page supplier answer at the same time they contain nearly the same information, aimed at two audiences.

Complete a short DPIA screening for anything touching personal data, and keep it on file.

Diarise a review in six months, because both the tools and the questions will have changed.

The short version

The questions are coming whether or not you are ready, and they are not difficult questions. They are simply questions nobody in your business has been asked before.

An afternoon spent finding out what your team actually uses, followed by two one-page documents, puts you ahead of most of your competitors on something clients are starting to weigh.

Business Matters covers this territory in more depth across its AI and technology sections